PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

PT-2026-104581

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An authorization bypass exists in the sessions REST endpoint query operation. This issue allows users with delegated RealmAdmin privileges to list sessions across different realms by supplying a...

CVE-2026-33439-OpenAM

CVE-2026-33439는 OpenAM16.0.6의 JATO ViewBean 엔드포인트에 영향을 미치는 사전 인증Pre-auth 안전하지 않은 역직렬화Unsafe Deserialization 문제입니다. 공개 권고문에서는 JATO 엔드포인트를 언급하지만 도달 가능한 경로를 열거하지는 않습니다. 이 연구는 /openam/ui/PWResetUserValidation을 도달 가능한 사전 인증 JATO 엔드포인트로 식별합니다...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM 사전 인증 RCE Echo 모드 명령 출력이 HTTP 응답에 직접 포함됩니다 — DNS 외부 유출이나 OOB가 필요 없습니다. 역직렬화 중 활성 JATO ThreadLocal 요청/응답에 접근하기 위해 com.iplanet.jato.RequestManager.getRequestContext를 사용합니다. 기존 Tomcat echo 기법Thread.target / ThreadGroup.threads 탐색이 실패하는 Java 21+에서 작동합니다. 사전 요구 사항 JDK 11+ 런타임 시...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 Pre-auth RCE in OpenIdentityPlatform OpenAM vi...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remot...

OpenAM v16.1.3

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...

Linux Distros Unpatched Vulnerability : CVE-2026-46498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core...

Linux Distros Unpatched Vulnerability : CVE-2026-45794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource fall...

Linux Distros Unpatched Vulnerability : CVE-2026-44203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently...

Linux Distros Unpatched Vulnerability : CVE-2026-45052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests ...

Linux Distros Unpatched Vulnerability : CVE-2026-47426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache witho...

Linux Distros Unpatched Vulnerability : CVE-2026-47424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to...

Linux Distros Unpatched Vulnerability : CVE-2026-45051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from t...

Linux Distros Unpatched Vulnerability : CVE-2026-62379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML...

Linux Distros Unpatched Vulnerability : CVE-2026-62280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects...

Linux Distros Unpatched Vulnerability : CVE-2026-53660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with...

Linux Distros Unpatched Vulnerability : CVE-2026-45048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce...

Linux Distros Unpatched Vulnerability : CVE-2026-62263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows eve...

Linux Distros Unpatched Vulnerability : CVE-2026-46619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the...